How to map data from raw logs to key/value pairs to be searched in Splunk?

[MayankSplunk]

I have splunk forwarder setup to forward cloudfront logs on S3, say following is the example of raw logs:

2015-01-15  20:59:36    LHR50   334 90.201.16.203   GET zfu.cloudfront.net

Can someone give me an example how to map them to key=value pairs? so I can query them in splunk

[dflodstrom]

I suggest using the field extractor. If you are running 6.2.x this feature has improved greatly. Have a look here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/ExtractfieldsinteractivelywithIFX

You can extract fields using props/transoforms but for simple extractions the Interactive Field Extractor works great.

[MayankSplunk]

Thanks for the reply, I was trying to do it as how explained below

http://docs.splunk.com/Documentation/AddOns/released/CiscoWSA/Configurew3clogfieldextractions

Cloudfront format is as following

Fields: date time x-edge-location sc-bytes c-ip cs-method cs(Host) cs-uri-stem sc-status cs(Referer) cs(User-Agent) cs-uri-query cs(Cookie) x-edge-result-type x-edge-request-id x-host-header cs-protocol cs-bytes time-taken

I tried steps mentioned in link above but still doesn't work, do I need to change prop.conf for this?

[aljohnson_splun]

Check out this documentation! It is what you need I think.

http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Createandmaintainsearch-timefieldextract...